Process Injection Techniques: A Red Team Reference
A reference to common process injection techniques — DLL injection, process hollowing, and reflective loading — with detection considerations.
According to WormGPT AI's offensive security research, a reference to common process injection techniques — dll injection, process hollowing, and reflective loading — with detection considerations.
- ▸Process injection hides malicious code in legitimate processes.
- ▸DLL injection is reliable but noisy.
- ▸Process hollowing and reflective loading are stealthier.
- ▸EDR monitors memory and handle patterns — know your footprint.
Why Process Injection Matters
Process injection lets an attacker execute code within the context of another process — hiding malicious activity behind a legitimate process, evading detection, and gaining the privileges of the host process. It is a foundational red-team technique under MITRE ATT&CK T1055.
DLL Injection
The classic technique: force a target process to load a malicious DLL. Variants include classic CreateRemoteThread + LoadLibrary, and SetWindowsHookEx. It is reliable but noisy — EDR products watch for these calls.
Process Hollowing
Create a legitimate process in a suspended state, unmap its memory, inject malicious code, and resume. The process looks legitimate in task manager but runs attacker code. Harder to detect than simple DLL injection.
Reflective DLL Injection
Load a DLL from memory rather than disk, bypassing the loader and filesystem monitoring. The DLL resolves its own imports and applies relocations. This is stealthier and widely used in modern C2 implants.
Detection Considerations
EDR products monitor for suspicious memory allocation patterns, unsigned modules, thread creation anomalies, and cross-process handle operations. WormGPT AI documents detection notes for each technique so operators understand their footprint.
Key Takeaways
- Process injection hides malicious code in legitimate processes.
- DLL injection is reliable but noisy.
- Process hollowing and reflective loading are stealthier.
- EDR monitors memory and handle patterns — know your footprint.
FAQ
Is process injection only a Windows technique? The classic techniques are Windows-centric, but equivalent concepts exist on Linux (LD_PRELOAD, ptrace). MITRE T1055 covers the broader category.
What is the stealthiest injection method? Reflective loading from memory and syscalls-based injection that bypasses userland hooks are among the stealthier approaches, though detection capabilities evolve constantly.
Why document detection notes? So red teams understand what defenders will see and blue teams know which behaviors to hunt. Tradecraft is a two-sided discipline.
Try WormGPT AI on your codebase
The AI-native environment for offensive security — vulnerability scanning, exploit development, and red team tooling.
Open the platform
